IS 12930 : 1991 IEC Pub 231 ( 1967)

Indian Standard

( Reaffirmed 2001 )

GENERAL PRINCIPLESOFNUCLEAR REACTOR INSTRUMENTATION
UDC 621,039*564 : 621.039-587

0 BIS 1991

BUREAU

OF

INDIAN

STANDARDS
MAR MARG Price Group 8

MANAK BHAVAN, 9 BAHADUR SHAH NEW DELHI 110002 July 1991

IS 12930 : 1991 IEC Pub 231( 1967)

Indian Standard -GENERAL PRINCIPLES OF NUCLEAR REACTOR INSTRUMENTATION
NATIONAL FOREWORD

This Indian Standard, which is identical with LEC Pub 231 ( 1967 ) `General principles of nuclear reactor instrumentation', issued by the International Electrotechnical Commission ( IEC ), was adopted by the Bureau of Indian Standards on the recommendation of the Nuclear Instrumentation Sectional Committee ( LTD 26 ) and approval of the Electronics and Telecommunication Division Council. Wherever the words `International as `Indian Standard'. Standard' appear, referring to this standard, they should be read

This Indian Standard recommends the following: a) Clause 2.5.8 - Selection of range should be assured by appropriate design ( including autoranging ). b ) Clause 2.6.3 - When built-in performance test facilities are used, the channel output should not participate in any control function. only the English language text of the International this Indian Standard. Standard has been retained while adopting it in
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1. 1.1

Introduction
General

Proper instrumentation, and efficient operation. 1.2 1.2.1 1.2.2 1.2.3
Scope

which gives a knowledge of the state of the reactor, is vital for safe

This Recommendation gives guidance on the provision of reactor instrumentation and recommends standards of good practice. The main body of the Recommendation is of general application and aspects applicable only to particular types of reactors are included in Appendices * Items of instrumentation are included only where they have a direct bearing on the over-all safety and effective control of the reactor.
General requirements

1.3 1.3.1

The responsibility for safe operation of a reactor should be vested in the management chain of command. Nevertheless, the design should facilitate safe operation under all credible conditions throughout the life of the reactor. The instrumentation should be such as to enable the operator to make an adequate assessment of the physical state and behaviour of the plant. Suitable warnings should be provided for indicating abnormal conditions. The degree of protection demanded from instrumentation should be determined from the following considerations :
a)

1.3.2

1.3.3

The situation where correct action of the safety system is required to avoid unacceptable hazard to the general public in case of accident. In this case, the safety system design should take into account the consequence of failure, and the degree of protection provided is determined by humanitarian, practical, economic and other considerations. The situation where unacceptable hazards to the general public cannot arise even though the safety system fails completely. In this case, the function of the safety system is to protect the plant against faults which would otherwise damage it, and to minimize the radiation exposure of persons employed in the process.

b)

1.3.4

Bearing in mind the diverse nature of possible incidents, the complex behaviour of the core as it becomes more irradiated, and the possible unknown errors in the mathematical model used to estimate the effect of the incident, there may be doubt as to whether detection by a single parameter can provide adequate protection. Whenever this is so, the incident should be sensed by at least two independent parameters, one of which should, wherever possible, be a direct measurement of the parameter of greatest concern.
are under consideration.

*) These Appendices
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1.3.5 The reactor control system and the reactor safety system should be as. nearly independent as possible, in the sensi that a fault in one should not lead to incorrect action of the other. In general, safety action should have priority over control action.
a)

The design of the reactor safety system should be such that no credible action or failure or malfunctioning of the reactor control system can lead to a situation in which protection is not provided by the reactor safety system. In considering failure of the control system, all credible combinations of failure should also be considered.

b)

The design of the control system should be such that no credible failure of the safety system can result in the increase of reactivity by the control system. In considering failure of the safety system, all credible combinations of failure should also be considered.

1.3.6

Where reactors have to be operated in conditions other than normal (for instance, commissioning), adequate safety and control arrangements shall still be preserved.

2. 2.1 2.1.1 2.1.2

Neutron flux measurement General

Neutron flux measuring instruments have an advantage over other types in that they can provide relatively rapid response with adequate sensitivity. For the safe operatioa of the reactor it is required that the neutron flux (or f&ion rate) be known over a very large range. In fault conditions, it is possible for the reactor period to be very short whilst the neutron flux is still low. If this occurred, the reactor power might increase so rapidly that, in some reactors, dangerous levels would be reached before steps could be taken to reduce the fission rate. Provision should be made to avoid such a danger in such reactors, e.g. by measuring the time variation of the neutron flux over the complete operating range.

2.1.3

When the fission rate at shutdown .is measured after the reactor has been operating for an appreciable time, account should be taken of the influence of fission product decay on these measurements. Where no single measuring assembly is found to be satisfactory for measurement of neutron flux in a reactor over the whole range of possible fluxes, it is necessary to provide a number of measuring assemblies with different types of instruments used in each assembly according to their suitability for measuring the flux levels in the particular range of interest. These assemblies cannot be defined exactly and will vary to some extent from one reactor to another.

2.1.4

2.2 2.2.1

Neutron .detectors

The design of neutron detectors for reactor control and instrumentation is influenced by the following demands of construction and usage, particularly in the case of ionization chambers used for high-flux measurement:

Is 12930: 1991
IEC Pub231(1%7)

Consistent with the required performance, dimensions would normally need to be the minimum, both in order to accommodate a sufficient number of detectors in a particular size of reactor, and in order to minimize the disturbance of the flux being measured. Detectors will normally require to be placed in a high-flux region to provide maximum accuracy and rate of response in measurement, which may also imply that the detector is subject to high temperatures. Constructional materials should, therefore, be compatible with such flux levels and temperatures, with particular regard to the maintenance of performance of insulators in such conditions. Constructional materials should also be selected in order to minimize induced radio-activity, since the latter will both interfere with neutron measurement and increase the difficulty of maintenance. Consideration should also be given to the effect of prolonged irradiation, on active materials used within the detector, so as to avoid loss of performance. 2.2.2 Neutron detectors require to be installed so as to have access to a thermal neutron flux which has a proportional'relationship to the rate of fission in the reactor. The installation should be such as to minimize changes in the ratio of reactor power output to neutron flux measurement for all reactivity adjustments that can be expected over thefull operating range of the reactor. The relative positioning of the detectors should be such that removal of any detector will not change the output of the others by more than an acceptable factor. In considering the number of neutron detectors to be provided for adequate protection of the reactor, consideration should be given to the effects of spatial flux distortion. Consideration may also be given to the provision of space detectors, unless easy replacement makes this unnecessary. 2.2.3 In order to obtain an output signal adequate for the instrumentation requirements, it may be necessary to provide a means of altering the position of the detector (or of a suitable neutron absorber). The adjustment of the detector position should, however, be limited so as to avoid an undesirable level of extraneous effects (for example, the pick-up of photo-neutrons). In addition, a positional adjustment will sometimes be necessary in the case of the low flux level detectors, in order to obtain an acceptable detector life. An arrangement is sometimes made to withdraw such detectors to a region of low flux when they are not in use, and the re-insertion of such detectors during shutdown shall be assured by appropriate means. The position of movable detectors should be known and be capable of being reproduced. The amount of movement and speed of adjustment should be chosen so as to avoid possible hazard; e.g. such as might arise when the detector is used in conjunction with the reactor automatic control equipment.

2.2.4

For measurement at low neutron flux levels, the measuring assemblies should be provided with means to obtain an adequate reduction of the effect of gamma rays. In those cases whereknowledge of very low neutron flux conditions is desirable, it is recommended that the proportion of the total signal arising from gamma flux, does not exceed 20%.

2.3

Neutron

sources

When a reactor is shut down, the flux may fall to a level at which it cannot be adequately monitored unless a neutron source is used. In order to ensure that a meaningful signal is obtained, before the reactor becomes critical, the position of the source should be such that at least 95 `Aof the neutrons detected will be due to fission when the reactor is about I % sub-critical.

5
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IEC P&Z31 ( 1967 ) 2.4 2.4.1
Instrumentation for neutron .flux ineasurements General

2.4.1.1 The neutron flux instrumentation
a) b)

has generally three functions:

safety ; measuring and indicating; automatic control.

c)
a) b)

The instrumentation for neutron flux measurements can be divided into three parts: linear current measuring assembly; logarithmic current measuring assembly; pulse counting assembly.

c)

2.4.1.2 Since the neutron flux has to be measured over a very large range, multi-range assemblies are generally used; alternatively certain types of assembly with adjustable range may be used, or the detector positions may be so adjusted as to cover the entire range of neutron flux. Whichever alternative is adopted, care should be taken that change-over or adjustment of range does not cause any diminution in reactor protection. Provision should also be made to ensure adequate protection of the reactor when the flux approaches saturation value of any assembly or the point at which the neutron flux in the reactor is no longer proportional to the detector output. In cases where change-over has to be made from one operational range to the other, the ranges should overlap by at least one decade.

2.4.1.3 Flux indicators should be so designed as to facilitate identification of those indicators which are valid, i.e. within their operational ranges, and it is useful if both local and remote indicators are so designed. 2.4.2
Linear current` measuring assemblies

Three types of assembly are commonly used:
a) b) excess flux protection assembly;

linear power measuring assembly; power deviation ,measuring assembly.

c)

In each case the input should be derived from one or more neutron-sensitive detector, situated in or adjacent to the reactor, so-that the flux level perceived is proportional to reactor power; the factor of proportionality should be, as far as possible, independent of control rod position and similar effects.
a) The excess flux protection assembly supplies information to the safety circuit, so as to cause the reactor to shut down as the power rises above a pre-determined level.

The ~assembly should provide a " safe " output only when power signal is less than the reference setting. All other conditions, including failure of the assembly or reference signal, should produce a " trip " output It is necessary that a " trip " output is obtained whenever a genuine trip condition exists, and the assemblies should be so designed, manufactured and tested to ensure that the number of spurious trips does not exceed the maximum permitted.

6
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The linear power measuring assembly is used to measure and display on a linear scale the

reactor power. At least one such assembly should be operable from a power source of such reliability that it will continue to indicate the reactor power during an electrical ,power outage or other emergency. The assembly should have a range up to at least 120% of full power, and, where required, additional switched ranges may be provided. The range switching should be clearly indicated. The accuracy for detector current measurement should be no poorer -than f 1% of full scale indication for all ranges where full scale indication is 10% of rated power or greater.

c)

The power deviation measuring assembly or backed-off linear assembly is used to measure and

display the power variation about a pre-set datum power level.

2.4.3
2.4.3.1

Logarithmic current measyring assembly

At const6nt reactivity, the rise of power is exponential; therefore, Cthe signal from the detector is fed to a logarithmic power amplifier, the output will rise linearly and the slope will be a measure of reactor period. Use can be made of these two features in logarithmic power amplifiers and period meters to provide an indication of power level and period over at least six decades of power without range switching. The upper range limit of such indications should extend to at least 110 % and preferably 120 % of full power. The lower limit of indication should be taken as the power level at which gamma and other spurious currents are not greater than 20% of the neutron current, but, in some cases, the period trip can be effective for short-period accidents at levels below this lower limit. The error of current indication, neglecting transient effects, should be within i 20% of the reading over the major portion of the range. The full scale deflection of the period meter should extend beyond the nominal trip setting range. The error of the period indication neglecting transient effects should not be greater than &lo% of reading.

2 The purpose of the period trip is to provide protection in situations where power level trip cannot provide protection. The response of the period trip should be as fast as is reasonable, considering the speeds of incidents and the time response of the shutdown devices. If the period protection is essential to the safety of a particular reactor, then the response time of the assembly shall meet the safety requirements. The root mean square noise level in the output of the period meter at any power level should be as low as possible consistent with the requirements of the assembly and particularly the speed of mesponse.
`ulse counting assemblies hese assemblies may be either linear or logarithmic; the.general recommendations

made for the rrent assemblies (Sub-clauses 2.4.2 and 2.4.3), should be applied except in so far as they relate the detectors. vtron sensitive detectors associated with pulse height discriminators have a low sensitivity to nrna radiation, and possess obvious advantages over mean current ion chambers for low flux
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IS 12938 -: 1991 IECPubW(1%7) level measurements. Care should be taken to ensure that a small change in gain of the assembly or in the polarizing voltage, ~does not change the indicated power significantly. 2.4.4.2 The count rate obtained in the shutdown state should demonstrate that the assembly is operating satisfactorily, i.e. that the count is not primarily due to the combined effect of spurious gamma interactions with the detector, external- electrical interference, or noise in the measuring circuit. In general, this is relatively easy to demonstrate for count rates of, IO-20 counts per second. However, paying due regard to the above effects, values.of count rate down to 2 counts per second when fully shutdown, and greater than 10 counts per second when ken (the effective multiplication constant) is about 0.99 are frequently used. Where lower count rates than 2 counts per second are experienced, the use of " critical approach " experimental techniques is assumed. At low power levels, the statistical accuracy of measurement is poor and consequently the pulse counting assembly requires a long time constant when operating at these levels. If a low count alarm or trip is fitted, the count rate at shutdown should also be such that frequent spurious alarms or trips are not obtained. The alarm or trip settings should, however, be such as to avoid unacceptable delays in initiation.

2.4.4.3 It may be necessary to retract the neutron pulse detectors or to add shielding to avoid radiation damage to them when the reactor power has risen above the range covered by the pulse counting assembly; the detectors should preferably be retracted to a position at which the surrounding neutron flux level is low enough to allow the assemblies to be tested while the reactor is at full power.

2.5
2.5.1

Flux level and flux rate trips

It is often desirable to initiate an alarm from a measurement assembly at alevel just prior to the one at which a reactor trip signal would be initiated. Such an alarmis termed a " low margin " alarm. Also, in order to draw the operator's attention to the fact that the margin between the flux level perceived by the assembly and the flux level at which a trip would be initiated has become excessive, an " excess margin " alarm may also . be provided. An excess trip margin may arise, for example, if an operator neglects to adjust the flux level trip after a programmed reduction in power and coolant flow.

2.5.2

Alarms or trips, as appropriate, should be provided on all assemblies against the variation of the polarizing potential outside acceptable limits. Every effort should be made to monitor the continuity of the complete assembly from the polarizing supply to the output of the measuring instrument. A flux level trip may be required from the logarithmic power amplifier; this trip Should be adjustable over the complete range by means of a visible control which has been pre-calibrated. It is also desirable to provide a warning of approach to this trip level. The pulse counting assembly should have both a high and low-count trip. The low-count trip is to demonstrate that the assembly is not in an operational condition. High-count trips shall not be able to be set for a count rate so high that a substantial number of counts are lost.

2.5.3

2.5.4

2.5.5

Period safety trips should be capable of operation at any value of positive period between onetenth of full scale (minimum period) deflection up to full scale of this deflection. A negative
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1slmo:1991 IECPobZ31(1%7) period safety trip is sometimes required. It may be necessary to provide a second against the approach to the period trip. Where period meters are tied in the assembly, a period trip can be provided, but it should be noted that the behaviour becomes unreliable near both the upper and the lower end of the pulse ,counting period warning $ulse counting of such a device range.

2.5.6

If movement of the ~detector is possible, spurious period signals may arise. Care should be taken to ensure that such signals do not lead to either a spurious shut-down or to an unsafe condition. Where the trip level must be adjusted by the reactor operator in accordance with operating conditions, and the difference between the parameter and the trip level~(i.e. the trip margin) must not be allowed to exceed a given limit, an. alarm may be provided to warn the operator of this condition (excess trip' margin alarm). An excess trip margin may arise, for example, if the flux level trip is not re-adjusted after a programmed reduction in power and coolant flow.

2.5.7

2.5.8

Where operation of an instrument on the correct range is essential, the selection of range should be assured by appropriate design.
' Calibration and testing of neutronjkx measuring assemblies

2.6
2.6.1

If it is necessary to indicate thermal power by meahs of neutron flux measuring instruments, these assemblies should be calibrated at full power against heat balance measurements. Since the ratio between reactor power and neutron flux, at the detector may vary with changes in flux.distribution in the reactor, the calibration should be performed when the xenon poisoning has also reached i equilibrium. Instrument ranges should have sufficient overlap to allow the low power ranges to be calibrated against the high power ranges.

2.6.2

Sub-assemblies and basic function units in a measuring assembly should be capable of being replaced by spare instruments without ~disturbing the calibration of the assembly. Special note should be made of the possible variations in pulse sensitivity between neutron detectors for a given polarizing supply voltage. To facilitate in situ testing, it is recommended that built-in performance test facilities`should be incorporated in all units wherever practical. The instruments should be so designed that tests may be made on the complete measuring assembly.

2.6.3

2.7

Measurement

of Jlux distribution

.

In addition to the measurement of thermal neutron flux outside the pressure*vessel, it is sometimes necessary to know the axial and radial flux distribution throughout the reactor core. Where this is so, appropriate means of measurement should be provided to enable the pre-determined flux pattern to be maintained.

3. 3.1 3.1.1

Temperature measurement General considerations

.

Measurement of temperature in a nuclear reactor is performed largely by conventional methods for the purpose of performantnde optimization, control and safety. It is necessary, however, to

fe:
3.1.2
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C?PubZ31(l%7) supplement conventional standards by recommendations dealing with problems peculiar tonuclear reactors. fn particular, consideration has been given to the effect of the physical and chemical changes caused by irradiation of the materials-of which the measuring devices are made. The number of points at which temperature measurements are made should be sufficient to allow effective control of the reactor to be retained if a reasonably foreseeable number of temperature detector failures should occur throughout its life. Where temperature measuring devices are irreplaceable, a~sufficient number of built-in spares should be provided.

3.2

Eflect of irradiation on accuracy of temperature measurement

The irradiation of materials in a reactor produces various effects whose magnitude depends on the type of radiation, the radiation level and the properties of the irradiated materials. In particular, attention is drawn to the following possibilities:
a) b)

introduction

of unwanted nuclear `heating of the detector materials;

alteration of the electrical resistance of conductors and insulators; creation of inhomogeneities in physical structure; transmutation of chemical elements and alloys.
1

cl
d)

3.3

Measurement

of fuel temperature

If fuel temperature is a critical parameter, the means of determining this should be suitable for both normal operating conditions, i.e. those in which the temperature does not exceed a predetermined level, and abnormal conditions, i.e. those in which fuel temperatures may exceed safe values and so necessitate adequate speed of response to initiate the protection system. In assessing the instrumentation requirements for the measurement of abnormal conditions, the relevant temperature ranges must be considered. Consideration should be given to temperature gradients in fuel, statistical variations of temperature through the reactor core and the number of fuel temperature measurements required. It is sometimes not possible to measure critical fuel temperatures directly, and such temperatures must, in this case, Abededuced from indication of nearby sensors, with due regard to thermal gradients and wheattransfer as affected by plant operation.

3.4

Measurement

of moderator temperature

For some reactors, it is necessary to measure the moderator temperature to establish its physical or nuclear behaviour. 3.5 3.5.1
Measurement General of coolant temperature

For some reactors, measurements of the bulk coolant temperature at the reactor inlet and outlet and also of the channel coolant outlet temperature are required in order tt% achieve satisfactory reactor control or protection, or both. The time-lag between indicated temperature and actual temperature should be consistent with acceptable measurement~errors introduced during x transients.
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If indications of coolant inlet and ~outlet temperatures are used and required for protection, they shall be fed into the reactor safety circuits to initiate appropriate alarm and trip mechanisms in the event of abnormal temperature conditions arising. Such measurements may constitute back-* up protection to the fuel element excess temperature trips. Where stratification of coolant flow may occur, the determination of sensors position and number should be carefully established if it is desired to calculate a temperature which is representative of the mean temperature of the coolant.

3.5.3

Channel coolant outlet temperature

The measurement of channel coolant outlet temperature will provide information which will assist the assessment of the radial temperature distribution across the reactor and will facilitate the control of all modes of instability to which the reactor may be subject.

3.6

Measurement of temperatures which are considered to be vitalfor reactor safety

When temperature level trips are required for reactor safety, they should -be derived from measurements at selected points, and the signals used solely for this purpose unless interaction can be substantially eliminated. For each trip, a number of independent measurements are required so as to operate an acceptably redundant coincidence-connected system. When considering fuel element temperature trips, measurements should be made on separate elements, thus avoiding multiple measurements on a single fuel element, which would necessitate a special design. The sensors should be so disposed that under the worst conditions of temperature distortion the reactor protection is not prejudiced.

A calibration of the measuring device is required within the range of the normal operating .emperature. If movable contacts are used in connecting trip temperature detectors, the design should be such that no significant spurious thermocouple e.m.f. is introduced due to these contacts under steady state and dynamic temperature conditions. 3.7
Temperature protection assembly

The excess temperature protection assembly should comply with the requirements protection system.

of the

Particular attention should be paid to requirements of fail-safe characteristics, high reliability and prevention of malfunction, leading to potentially hazardous conditions.

3.8

Presentation of temperatures

Nuclear reactors may require special consideration in the presentation of temperature measurements on account of the large number of measurements required and the need for rapid assessment by the operator. 4.
4.1 Coolant measurements General considerations

Where a coolant flow is required for reactor safety, a suitable protection equipment shall be installed such that any unsafe pressure or flow conditions will cause corrective action to Abe initiated. It is thus necessary to provide means for either direct measurement or inference of the pressure and flow in the coolant circuit.

11
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An indication of the mass flow in each coolant circuit should be presented in the control room at a place where this indication may be readily and.easily seen by the operator when adjusting the appropriate flow controls. The selected method of obtaining the flow measurement should be the most direct possible and should give reliable indication of flow over the whole operating range. The measurement should be made in such a position that it will measure flow variation due to both pump speed variation and valve movement. If the flow rate is significantly modified, unsafe flow conditions may occur; alarms or corrective actions should therefore be initiated by failure of any device such as a valve, pump or circulator, capable of modifying the flow rate significantly. Loss of power to any such device should also initiate a similar signal. The means of reducing reactor power in the event of unsafe flow conditions should be initiated directly from the reactor safety system, and these measurements should be combined in a suitable redundant combination so that when the flow loss exceeds that operationally permissible, automatic shutdown is initiated ~by the safety system.

4.2.2

System requirements

Any system of fiow-failure protection should enable operation of the reactor to continue at reduced power when individual heat transfer circuits are isolated for maintenance. The time response of measuring assemblies should be adequate for protection. Any part of the detection installation which projects into the coolant ducts should not interfere with any inspection work which may be required on the duct, should be securely fixed, and should be constructed of materials compatible with the fuel element can and the coolant.

4.3 4.3.1

Coolant pressure General

It is necessary both to ensure an adequate mass flow of coolant under all conditions and to maintain the coolant pressure at the design figure at all power levels. Leakage from the pressure circuit'may vary from a minor leakage to a large escape following a major rupture of the coolant circuit. For these reasons, coolant pressure shall, and rates of change of pressure may, be measured. Supplementary differential pressure measurement may be required at sealing points, as a check on their integrity, and across isolating valves in the coolant circuit, so that the correct coolant flow conditions may be properly established prior to bringing a fresh coolant circuit on line. This requirement will depend upon the design of the plant and in particular upon the characteristics of the coolant circulator, pumps, blowers, etc.

4.3.2

Constructional features

\

If it is proposed to use the coolant as a means of transmitting a signal beyond the confines of the pressure circuit, measurements should in no circumstances be prejudiced by the presence of
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solid matter in the coolant, and, if filters be provided, they should not prejudice the measurement even if clogged. Standby filters should also be provided, or allowance should be made during calibration for subsequent filter pressure drop. The bore of any components employed in the measuring circuits should be as large as is consistent with accuracy and good practice, and it is necessary that any pipework introduced into the coolant circuit be of a suitable material, stainless steel being acceptable in most cases. Pneumatic or electric transmission system should be used to obviate the need to bring pressure pipes into the control room or other vital areas.
4.4

Coolant level In liquid-cooled reactors, ,coolant level instrumentation should be provided to help keep the level within specified limits in order to ensure adequate circulation through the core and to prevent cavitation occurring in the circulator pumps.
<

In reactors where water is used as a radiation shield, instrumentation should be provided to ensure that an adequate level is maintained and that the fuel elements remain shielded.

4.5

Coolant leakage Because .of the possible toxic .and radio-active nature of escaped coolants, and as a first indication of other forms -of abnormality, the rate of coolant make-up should be continuously recorded as a check on coolant leakage. Provision should be made for a warning to be given when this rate exceeds a permissible level.

4.6

Coolant puritj In some reactors, coolant purity measurements are necessary to establish the state of chemical reactions between coolant and the remainder of the reactor. Analysis of the primary coolant or, in some cases, of the secondary steam or coolant, can also ive an indication of leakage between the primary and a secondary circuits.

4.7

Coolant activity Coolant activity measurements may be used for different purposes, such as:

4.7.1

Helping to establish the amount of activity released during any intentional or accidental release of coolant. Detection and location of defective fuel elements. Checking the operational effectiveness of the coolant purification circuit.

4.7.2 4.7.3

5.

Protection systems

Under consideration.
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General requirements

6.1.1.I In order to achieve safe control of the reactor, it is essential to maintain services to all reactor instrumentation connected to the protection circuits, services to the reactor warning system and to that instrumentation which relates to essential auxiliary plant. 6.1.2 The prevailing reactor conditions should be continuously monitored, and this implies that~certain instrumentation should be available at all times and should operate within the specified limits of accuracy. It may, therefore, be necessary to provide a'guaranteed supply system or systems.

6.2 6.2.1

Guaranteed supply systems Electrical supplies

6.2.1.1 Where instruments are d.c. operated, a battery-backed dc. supply will prove the most reliable. At the present tjme, a.c. is the predominant supply requirement for electronic instrumentation and consequently a reliable a.c. supply system should be provided. 6.2.1.2 In designing such a system, account should be taken of the following:

a) No single supply is considered to be sufficiently reliable. Even though provision may be made
in the form of a special qotor-alternator set, efforts to make the system reliable will inevitably result in some additional complexity which will tend to defeat the fundamental requirement.

b) Multiple systems may be employed with either change-over contactors or machine duty
reversal, but the transient disturbance which may ensue during change-over should not prejudice the safety or otherwise disturb the operation of the reactor.

C) The capacity of the standby system should be such that the instrument load can be maintained.

4

Motor-generator sets which are used to supply a.c. chart drives should be frequency controlled . in order to maintain timing within acceptable limits.

e) Supplies to essential recording and warning instruments should be maintained at all times, so
that the operator may make an appraisal of any fault conditions, even though the reactor may have shut down. 6.2.2
Pneumatic supplies

6.2.2.1 Where pneumatic supplies are essential ~for reactor safety (e.g. detector assembly movement, instrument operation) the supply system should satisfy the requirement of Sub-clause 6.2.1 where appropriate, and in addition:

a) it should initiate an alarm on the occurrence of any significant drop in pressure and shall
initiate suitable corrective action on any malfunction severe enough to~jeopardize the safety of the reactor;

b) the layout of its pipework, compressors, receivers and any associated -equipment should be
such that, in the event of their fracture, no damage which may endanger the reactor will be caused to any other equipment;

c) the pneumatic supplies should be clean and dry, i.e. have a dewpoint low enough to prevent
any condensation of vapour at the lowest prevailing temperatures.
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1.1

Co-ordination of the facilities for controlling the reactors and associated plant is necessary in order to promote safe, efficient operation, and the provision of a central control room to perform this function is strongly recommended.
a<`.

b

:.

`,
' <.. ..

The location of the central control room and the layout of the facilities provided should take account of the normal method of operating the plant and of the actions and procedures necessary in combating any major or minor hazards which could credibly be postulated as likely to arise during the life of the reactor. In these considerations, account should be taken of the number, function and status of personnel normally attending the plant and of the means of communications cnecessary to co-ordinate their activities.

7.2 7.2.1

Control room siting Position relative to,items of plant

The central control room should be sited so as not to be vulnerable to damage nor made untenable in the event of major accidents. Nevertheless, as far as possible, it should have ready access to the reactors and associated .plant, including emergency auxiliary equipment,

7.2.2

Enviroumerztal factors

The location of the control room and related equipment annexes should, whenever possible, fulfil the following general requirements:
a)

be quiet and free from vibration;

ZJ) be adequately heated, ventilated, or air-conditioned, particular attention being given to the reliability of installations necessary to obtain these conditions in rooms housing instruments whose performance varies with changes in room temperature.

7.3 7.3.1

Control room layout Stafing and method of operation

7.3.1.1 Consideration should be given to the number of staff required for controlling the reactor and associated plant, both under normal and emergency conditions. This factor will, to some extent, reflect the degree of automation of the procedures for controlling and observing the state of the plant. The control room should, however, be arranged to include, under direct supervision and control of the operators, all items of plant having a significantreffect on the state of the reactors, together with all auxiliary plant necessary to maintain thesafety of the reactor under conditions ofemergency.

7.3.1.2 In large nuclear installations, some measure of local control and instrumentation of plant associated

with the reactor is required to facilitate efficient operation, but these should be capable of being over-ridden by duljlicate controls and instrumentation in the main control room for those plant items whose proper functioning affects the safety of the reactors. Similarly, in large installations, facilities should be available for the over-all supervision of other equipment affecting the operational state of the reactor to enable an operator to take precautionary action should this become necessary, and also, where required, to enable him to co-ordinate the over-all functions of the installation.
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IS 12930 : 1991 IEC Pub 231( 1967 ) 7.3.2
Layout of control and instrum&t desks (and boards)

7:3.2.1 The information and controls required in the control room may be divided into three groups:
a)

those which have to be arranged on the reactor control and instrument desk so that they fall immediately under the eye and hand of the operator, who will give them continuous attention; those which should be available for easy reference from the reactor control and instrument desk ; those which should be readily accessible for inspection but which need not be visible from the control and instrument desk.

b)

c)

7.3.2.2 Every effort should be made to simplify equipment in the categories quoted in Sub-clause 7.3.2.1, items a) and b), and to keep complex equipment likely to require regular maintenance away from the control and instrument desk. The use on the desk of simple indicators rather than recorders is desirable, except where the trend of the measured quantity is required for immediate control purposes. 7.3.2.3 In large, installations, equipment such as amplifiers and relays associated with the instruments and controls in the categories quoted in Sub-clause 7.3.2.1, items a), b) and c), should, where possible, be mounted in a separate but adjacent equipment room, where normal access for control purposes is not required. Normal access to this room should be through the control room only.

7.3.3

Grouping of instrument and controls

7.3.3.1 Instrumentation indicating the state of important reactor parameters should be prominently and clearly displayed, preferably in such a way that the operator may control the plant from a minimum number of indications. These indications should be grouped in relation to related controls used during normal operations. 7.3.3.2 The essential controls used in normal operations should be at the control and instrument desk The supervision of all automatic control loops should be from the control and instrument desk, including manual override facilities. 7.3.3.3 The operator should normally be able to control the reactor conditions without leaving the control and instrument desk. However, in large installations, additional facilities are provided which both present information and enable override control of local plant items to be effected. These include controls for auxiliary plant essential to reactor safety during emergency conditions, which may be either manual or automatic in operation according to the nature of the hazard. The grouping and layout of these controls and indications should be such that in a major emergency the~operator can Feadily determine the state~of reactor parameters likely to be affected and the operational state of essential auxiliary plant; additionally, the layout should facilitate rapid correction of minor faults with a view to maintaining the plant in operation.

7.3.3.4 The instruments mentioned in Sub-clause 7.3.2.1, item b), may be accommodated on vertical panels arranged in an arc, with the control and instrument desk near the geometrical centre. The controls and indicators should be arranged in logical order and grouped in relation to items of plant (e.g. all instruments and controls relating to one heat exchanger should be on one panel).
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IS 12930 : 1991 IEC Pub 231( 1967 ) 7.3.3.5 Visual indicators should be prominently displayed and clearly visible from the control and instrument desk. Indicating instruments should be designed to be read with reasonable accuracy from the desk, and the dial diameter should be not less than one-fortieth of the distance of the indicator from the operator when seated at the desk. 7.3.3.6 Typical requirements for the remaining information and controls include instruments producing chart records required mainly for record and analytical purposes and may include instruments with associated repeaters providing the,indications listed in Sub-clause 7.3.2.1, item b). 7.3.3.7 These items may be arranged in a separate space, but should then be adjacent to the main control and instrument board. 7.3.4
7.3.4.1 Grouping of alarms

The number of alarms operating into the control room should be restricted to the necessary minimum. However, individual alarms should be provided for all emergency conditions requiring corrective action fr,om the control room and these should he displayed in the vicinity of the appropriate control and instrument board. For all emergencv conditionsnot requiring corrective action from the-control room, alarms should operate locally at the affected plant with a single group alarm into the control room.

7.3.4.2 The grouping and layout of alarms associated with the safety circuits should be prominently displayed to promote rapid appreciation of the state of the circuits and of the operational state of by-pass facilities. 7.3.4.3 Where data handling equipment. is supplied, the alarm indication should be located in the control room and the logging output should be in an adjacent room.

7.4 7.4.1

Communicatioik

The possible consequence of failure of the communication services are more serious in nuclear power plant than in most commercial fields and the specification for the communications equipment must, therefore, be considerably more stringent. It has been found in practice that some of the telephone exchanges commercially available are not sufficiently reliable and a number of points are therefore listed below to which particular attention should be paid in order to ensure that adequate reliability is achieved.

7.4.2

The communication facilities to be provided should comprise:

7.4.2.1 An automatic telephone exchange for normal commuiiications within the plant. 7.4.2.2 An auxiliary manual system to maintain, in an emergency or in the event of failure of the supply to the main automatic exchange, communications from the control room to a (minimum) number of strategic operating points. 7.4.2.3 A small number ~oftelephones giving direct access to the national system without the intermediary of the plant automatic exchange. 7.4.3 In addition to the above, an alarm annunciator system, facilities for the location of operational staff, a fire warning system and a site emergency alarm system are necessary.
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IS 12930 : 1991 IEC Pub 231( 1967) 7.4.4 It is anticipated that the manual telephone system will provide communications from the control room to selected and main operating points only, primarily on a radial basis. It should also permit interconnection between extensions, with supervision, and should provide conference facilities.

7.4.5 7.4.5.1

In the design of the manual It should congestion provide adequate

system consideration essential system. operational

should be given to the following communications

points: of, or

in the event of failure

on, the automatic

7.4.5.2

This manual telephone system should take its supply from a source as far as possible independent of the main station telecommunication battery, to ensure that in the event of failure of the latter all communications within the station will not be lost. It is desirable that this system should provide even though the telephone is off its rest. The cabling provided system. consideration The cabling should be given to the installation of a limited of the for the manual facilities to enable an extension to be recahed,

7.4.5.3

7.4.5.4

system should

be independent

of the cabling

serving

the

main automatic 7.4.6 In addition

to the above facilities,

number of sound-power instruments. cabling of any other system. 7.4.7

for this system should

be independent

In both the automatic and the manual telephone systems, the control room should adequate number of extensions from which one should be reserved for emergency calls.

have an

8.

General alarms Under consideration.

